HOUSTON COMMUNITY COLLEGE

Internal Audit Annual Report Fiscal Year 2021
in Accordance with the Texas Internal Auditing Act

Prepared by Internal Audit Department
Terry Corrigan, Director Internal Audit

Table of Contents

SECTION
Internal Audit Plan for Fiscal Year 2021	I
Quality Assurance Review	II
Summary of Observations & Management Action Plans	III
List of Consulting Engagements and Non-audit Services Completed	IV
Internal Audit Plan for Fiscal Year 2022	V
External Audit Services – Fiscal Year 2021	VI
Reporting Suspected Fraud and Abuse	VII
Compliance with TGC, Section 2102.015: Posting the Internal Audit Plan, Internal Audit
Annual Report, and Other Audit Information on the HCC Website	VIII

I.	Internal Audit Plan for Fiscal Year 2021

The Board of Trustees approved the FY 2021 Internal Audit Plan on August 5, 2020. The HCC audit universe was developed through HCC’s Enterprise Risk Management Assessment Program (ERM). The High Risk Audit Candidates are updated based on the assessment of the following: 1) governing board members input, 2) ERM interviews conducted with Executive Council members, College Presidents and other chief executives, 3) top risks identified by the United Educator’s Risk Management Premium Credit program, 4) KPMG’s 20 key risks to consider by Internal Audit 2020, and 5) alignment with HCC’s strategic priorities.

A FY 2021 Internal Audit Plan Status Report is detailed in the following table.

I

Houston Community College	Internal Audit Annual Report

FY 2021 Internal Audit Plan Status Report as of August 31, 2021

Audit Projects	Project
Number	
Stage	Report
Issued	
Notes/Issues	
Operational Audit Projects					
SACSCOC Accreditation - Follow -up	18-O-1	Complete	09/15/20	Report issued Tuesday, 9/15/2020	
PeopleSoft Application Controls	18-O-3	Complete	11/03/20	Report issued Tuesday, 11/3/2020	
Student Behavioral Intervention Review	19-O-1	Complete	09/30/20	Report issued Wednesday, 9/30/2020	
Enrollment	20-O-1	Not Started		Rollover to FY 2022 Plan	
IT Active Directory and Window s Server	21-O-2	Complete	09/17/21	Report issued Friday, 9/17/2021	
IT Governance	21-O-3	Not Started		Rollover to FY 2022 Plan	
IT Change Management	21-O-4	Complete	09/21/21	Report issued Tuesday, 9/21/2021	
Construction Cost Management	21-O-5	Fieldw ork		Rollover to FY 2022 Plan	
Compliance Audit Projects					
Required Regulatory Reporting - Follow -up	18-C-4	Complete	09/30/20	Report issued Wednesday, 9/30/2020	
Web Content Accessibility Guidelines Review	19-C-2	Fieldw ork		Interim audit report issued 10/10/2019	
Campus Saf ety & Environmental Operations Management	21-C-1	Not Started	N/A	Rollover to FY 2022 Plan due to COVID	
Central College	21-C-1-1	Not Started		Rollover to FY 2022 Plan due to COVID	
Northeast College	21-C-1-2	Not Started		Rollover to FY 2022 Plan due to COVID	
Coleman College	21-C-1-3	Not Started		Rollover to FY 2022 Plan due to COVID	
Cares Act	21-C-2	Fieldw ork		HEERF I Interim report issued Monday, 8/30/2021	
TRS Retirement Payments	21-C-3	Complete	10/19/20	Report issued Monday, 10/19/2020	
Title IX New Regulations	21-C-4	Complete	08/30/21	Report issued Monday, 8/30/2021	
Senate Bill 212	21-C-5	Complete	03/30/21	Report issued Tuesday, 3/30/2021	
Grants Compliance	21-C-6	Complete	09/23/21	Report issued Thursday, 9/23/2021	
Advisory Services Projects					
Campus Security	19-S-3	Not Started		On hold - consultant to help establish the program	
Quarterly Control & Compliance Attestation Process	20-S-4-1	Complete	03/30/21	Report issued Tuesday, 3/30/2021	
Committees & Task Forces	21-S-1	N/A	N/A		
Continuous Auditing	21-S-2	N/A	N/A		
Special Projects & Examinations	21-S-4	N/A	N/A		
Procurement Small Business Practices	21-S-4-1	Complete	05/13/21	Report issued Tuesday, 5/13/2021	
HCC Ethics/Culture Review	21-S-4-2	N/A	N/A	Consultant hired to complete	
Strategic Plan Metrics Reporting Review	21-S-4-3	Not Started	N/A	Rollover to FY 2022 Plan	
Adm inistrative Projects					
FY 2022 Audit Planning  & ERM Assessment	21-A-1	Complete	08/04/21	FY2022 IA Plan approved by BOT, August 18, 2021	
TeamMate IA Management System	21-A-2	Implementing	N/A		
External Quality Assurance Review (Basil Woller Associates)	21-A-3	Complete	05/07/21	Basil Woller issued final report Friday, 5/7/2021	
FY 2021 Annual Audit Report	21-A-4	Complete	10/06/21	Present to BOT October 6, 2021	
External Audits Monitoring	21-A-5	N/A	N/A		
Lunch and Learns	21-A-6	N/A	N/A		
New sletters	21-A-7	N/A	N/A		

I-1

II.	Quality Assurance Review

An external quality assurance review (EQAR) was performed by Basil Woller and Associates (Basil Woller) on the Internal Audit Department in FY 2021, in compliance with the Institute of Internal Auditors International Standards for the Professional Practice of Internal Auditing (Standards). The review was an independent validation of the assertions and conclusions made in the internal audit report “20-A-3 IA Internal Quality Assurance Review” issued by the HCC’s Internal Audit Department on June 23, 2020. Basil Woller’s report issued May 7, 2021, concurred with the Internal Audit self-assessment, that HCC’s Internal Audit Department generally conforms with the Standards and the IIA Code of Ethics. This level of conformance is the top rating and demonstrates a clear intent and commitment to achieving the Core Principles and the Definition of Internal Auditing.

The HCC Internal Audit Department completed the following quality assurance activities during FY 2021:
1)	Maintained a professional staff with diversified skill sets and professional certifications;
2)	Completed training to maintain professional certifications and to improve knowledge and understanding required to complete audit projects; and
3)	Collaborated with the Risk Management Office to update and complete the annual Enterprise Risk Management Assessment for HCC.
1)	

III.	Summary of Observation and Management Action Plans

See the detailed FY 2021 Audit Observations and Management Action Plans Attachment to this report

IV.	List of Consulting Engagements and Non-audit Services Completed

Internal Audit provided a lunch and learn on “Fraud Awareness”. Members of the Internal Audit Department participated on the following councils, task forces, and committees in FY 2021:

1.	Compliance Partners Council

2.	Internet and Communication Technology and Accessibility Committee (ICTA)

3.	Procurement Contract Evaluation Committees

4.	Candidates for Hiring Screening Committees

5.	Reopen HCC Task Force
1.	

V.	Internal Audit Plan for Fiscal Year 2022

The HCC Board of Trustees approved the Fiscal Year 2022 Internal Audit Plan on August 18, 2021.

Executive Summary

The purpose of the Internal Audit Plan (Plan) is to outline audits and other activities the Houston Community College (HCC) Internal Audit Department (the Department) will conduct during fiscal year 2022. The Plan’s development and approval are intended to satisfy requirements under Board Bylaws, Audit Committee Charter, Board Policy CDC (LOCAL), HCC’s Internal Audit Charter, International Standards for the Professional Practice of Internal Auditing, and Texas Internal Auditing Act.

A significant amount of time will continue to be devoted to collaborating with HCC’s Risk Management Office and other control monitoring functions within HCC to further refine the Enterprise Risk Management (ERM) Assessment Program during FY 2022.

Plan Development Methodology

The HCC audit universe is developed through HCC’s Enterprise Risk Managem ent Assessment Program (ERM). The High Risk Audit Candidates included in the plan are based on the assessment of the following: 1) governing board members input,
2) ERM interviews conducted with Chancellor’s Council members and other chief executives, 3) use of consultants, 4) external audits, 5) top risks identified by the United Educator’s Risk Management Premium Credit program, 6) KPMG Internal Audit Key Risks and Focus Areas for 2021, 7) standards for the professional practice of internal auditing, 8) Texas Internal Auditing Act, and 9) alignment with HCC’s strategic priorities.

Internal Audit Department Fiscal Year 2022 Audit Plan
No.	Project	Description	
Operational Audit Projects	
20-O-1	*Enrollment	Review enrollment streamlining to facilitate student grow th and retention including coordination w ith financial aid	
21-O-3	*IT Governance	IT management of business requirements and optimization  to deliver functionality,
dependability, & support	
21-O-5	*Construction Cost Management	Focusing on the WHE project, review process for competitive contracting compliance w ith regulations, invoice payment approvals, accounting, and HCC policies & procedures compliance	
22-O-1	Def erred Maintenance	Review propriety of the program for identifying, risk assessing, prioritizing, cost tracking, and reporting maintenance projects	
22-O-2	IT Cyber & Data Security	High level general controls review of the inf ormation technology data security
management system	
22-O-3	IT Disaster Recovery	Evaluate processes and procedures for IT disaster recovery including compliance w ith regulations and HCC policies. Additionally IA w ill attend and observe the annual disaster recovery exercise.	
Compliance Audit Projects	
19-C-2	*Web Content Accessibility Guidelines Review - Follow -up	Review the implementation of CRB (REGULATION) to ensure that qualified individuals w ith disabilities have access to the College District’s technology resources	
21-C-1	*Campus Saf ety & Environmental Operations Management	Planning for campus saf ety & environmental legal policy compliance management review s	
21-C-1-1	*Central College	Saf ety & environmental legal policy compliance	
21-C-1-2	*Northeast College	Saf ety & environmental  legal policy compliance	
21-C-1-3	*Coleman College	Saf ety & environmental legal policy compliance	
21-C-2	*Cares Act - HEERF II & III	Review management process to ensure compliance w ith terms	
22-C-1	Pcard Process	Review propriety of the Pcard process & activity compliance w ith program procedures. External audit management letter resolution.	
22-C-2	Below $100,000 Procurements Review	Review procurement activity below $100,000 for compliance w ith regulations and HCC policies & procedures	
22-C-3	Procurement Contracting Review	Review the general contracting process for compliance w ith regulations and HCC
policies & procedures	
Advisory Services Projects	
19-S-3	*Campus Security	Work w ith all HCC stakeholders in evaluating  the implement ation of a Campus Security
Program	
21-S-4-3	*Strategic Plan Metrics Reporting Review	Review the propriety of progress reporting to the BOT using the Strategic Plan’s performance metrics	
22-S-1	Committees & Task Forces	Participate on committees and task forces providing risk management and control
advice	
22-S-2	Special Projects & Examinations	Responsive to provide services as required	
Adm inistrative Projects	
22-A-1	FY 2023 Audit Planning & ERM
Assessment	Collaborate w ith HCC Risk Management to update the Enterprise Risk Management
(ERM) assessment & audit planning	
22-A-2	TeamMate IA Management System	TeamMate  softw are system maintenance & improvement	
22-A-3	Internal Quality Assurance Review	Perform a formal internal quality assurance review on IA	
22-A-4	FY 2022 Annual Audit Report	Compile and prepare State required annual audit report	
22-A-5	External Audits Monitoring	Monitor external audit activities on HCC and related observation action plans	
22-A-6	Lunch and Learns	Presentations to HCC's general personnel to raise aw areness on fraud deterrence, risk management, internal control & compliance	
22-A-7	New sletters	New sletters to HCC's   general personnel to raise aw areness on fraud deterrence, risk
management, internal control & compliance	
Observation Action Plan Follow -ups	
22-F-1	Observation Action Plan Follow -ups	Follow -up on completion of audit observations action plans	
* Carry-over/continued projects from FY 2021 Internal Audit Plan	

V-1

VI.	External Audit Services – Fiscal Year 2021

HCC Procured Services in FY 2021

1.	Texas Mutual Insurance Company – Workers’ Compensation
2.	Whitley Penn – Annual Financial Statements Audit
3.	Dr. Jared S. Graber Educational Consulting performed quality assurance reviews during the development of the SACSCOC Compliance Certification
4.	Berkeley Research Group reviewing HCC’s current campus security environment providing guidance to establish HCC’s campus security program
5.	Myers and Stauffer – IT cyber & data security penetration testing
6.	Basil Woller & Associates – external quality assurance review on HCC’s Internal Audit function
7.	Martinez Partners/McConnell & Jones/Dr. Roderick Paige grants processing review
8.	Charlesworth Consulting insurance program evaluation Regulatory Imposed in FY 2021
1.	Weaver engaged by Houston-Galveston Area Council to perform 2020-2021 Financial Monitoring & Billing Review on contracts 213-20 & 213-21
2.	THECB performed a Perkins Career and Technical Education – Basic Grants to States desk review for academic year 2018 – 2019
3.	THECB programmatic desk review under the Carl D. Perkins Basic Grant Program with review period being the 2019 – 2020 funding year
4.	San Jacinto College – FY 2020 Sub-Recipient Monitoring Review for the U.S. National Science Foundation, Louis Stokes B2B Alliance: Harris County Community College Alliance Grant Program
5.	THECB review of compliance with the requirements enacted by HB-1735, 86th Regular Session, Texas Legislature. Review of compliance with requirements for institutional policies on sexual misconduct
6.	Texas Workforce Commission performed a desk review on HCC’s CAFR to ensure compliance with the U.S. Code of Federal Regulations Part 200, Uniform Guidance, Uniform Grant Management Standards, and State of Texas Single Audit Circular
7.	State Auditor’s Office performed a Public Funds Investment Act compliance review
8.	Workforce Solutions – Gulf Coast Workforce Board performed Equal Opportunity and Accessibility Review PY 2021
9.	Correctional Education Association – Harris County Jail/HCC corrections education program three year accreditation audit
1.	

VII.	Reporting Suspected Fraud and Abuse

HCC has taken the following actions to implement the fraud detection and reporting requirements of Section 7.09 of the 83rd Legislature’s General Appropriations Act, and Texas Government Code, Section 321.022:

•	All employee mandatory annual Standards of Conduct training has been established.
•	HCC has established a confidential independent Hotline for people to report suspected fraud, abuse, and unethical behavior. A link to the reporting Hotline is on the HCC website home page. Reporting Hotline information is included in mandatory annual Standards of Conduct training.
•	The HCC Compliance and Ethics website has a link to the State Auditor’s Office fraud hotline.
•	In compliance with the reporting requirements of fraud, waste, and abuse, HCC reports all instances of confirmed fraud, waste, and abuse to the State Auditor’s Office.
•	

VIII.	Compliance with TGC, Section 2102.015: Posting the Internal Audit Plan, Internal Audit Annual Report, and Other Audit Information on the HCC Website

TGC, Section 2102.015 was added by House Bill 16 (83rd Legislature, Regular Session) on June 14, 2013. Colleges are required to post certain information on their website. Specifically, Colleges must post the following information within 30 days of approval by the Board of Trustees:
•	The approved audit plan for the current fiscal year.
•	The annual audit report for the previous fiscal year.
•	A detailed summary of the weaknesses, deficiencies, wrongdoings, or other concerns raised by the audit plan or annual report.
•	A summary of the action taken by the College to address concerns raised by the audit plan or annual report.

HCC Internal Audit will submit the Internal Audit Annual Report to the website coordinators for posting on the Internal Audit section of the HCC website no later than 30 days after the HCC Board of Trustees approves the report. The current fiscal year audit plan has been posted to the website. This report includes the TGC, Section 2102.015 standard elements.

FY 2021 Audit Observations and Management Action Plans

Project Name	
Obs #	

Observation Description	

Remediation Action	
Responsible Person	Status/Est
Completion Date	
20-O-2 Business Continuity Plan	1A	The template being used for the risk assessment has not been updated in the overall institutional BCP. A risk assessment has been incorporated in the EOP but the BCP does not reflect this change. The BCP should be updated to reflect the EOP risk assessment. Defining credible events during a risk assessment can ensure that risks are understood and appropriately managed.	The Business Continuity Plan will be revised and updated. The revisions will include the following:
•	Incorporate the annual hazard and vulnerability risk assessment that is included in the Emergency Operations Plan.
•	Incorporate lessons learned from the pandemic response including the transition to remote work.
•	Expand the communications strategies to specifically address public information office functions including media relations.
•	Incorporate opportunities for improvement identified in after action reviews.
•	Integrate the testing, training and exercise program into the program used for the Emergency Operations Plan.	Executive Director - Risk Management	In Progress 8/31/2021	
	1B	A business impact analysis (BIA) should be documented for all HCC critical business areas. We were unable to verify that a BIA exists for all critical areas. The BIA is the foundation of a BCP. BIA is used to identify the critical processes that need to be recovered following a disaster event. An organization is placed at greater risk without a current BIA to provide adequate direction	The completion of the departmental/college specific business continuity plans will require a series of facilitated workshops with the respective departmental/college leadership. The workshops will guide the departments through the completion of department / college specific business continuity plan templates. The department specific continuity plans will include the identification of essential functions / critical processes and the completion of a business impact analysis.	Executive Director - Risk Management	In Progress 10/30/2021	
	1C	The HCC overall institutional BCP lacks some documentation. Procedures for how to handle some events are not specifically addressed in the Plan. Some of these events include remote work, media inquiries and pandemic illnesses. In addition, the documentation for the Campus BCPs and the Functional Unit BCPs has not been
completed.		Executive Director - Risk Management	In Progress 10/30/2021	
	1D	HCC BCP(s) are not reviewed per the established Review Table included in the overall institutional BCP. BCPs should be reviewed at least annually. The overall institutional plan has not been updated since 2016. While many elements of the BCP have been incorporated into the EOP and updated annually, the BCP does not reflect these changes. The BCP does not include the most recent regulatory guidance. In addition, After Action Reports (AAR), which reflect lessons learned from prior events, have not been incorporated into the BCP. BCPs should be updated formally and timely to reflect updates in regulations and lessons learned from events, tests, trainings, and exercises. BCPs decline over time and become less effective as people, processes and technology change. Changes in the operating environment need to be reflected in the plans		Executive Director - Risk Management	In Progress 10/30/2021	

Project Name	
Obs #	

Observation Description	

Remediation Action	
Responsible Person	Status/Est
Completion Date	
	2A	HCC should develop a written disaster communication strategy. Risk Management should collaborate with key HCC contacts and personnel to develop documented notification procedures and clearly assign job responsibilities in the event of a disaster. Clear communication during a disaster increases timely and orderly
recovery.	Risk Management will collaborate with Communications, IT, and the HCC Police Department to formalize emergency notification and communications protocols.	Executive Director - Risk Management & Manager - Emergency Management	In Progress 12/31/2021	
	2B	HCC is not performing regular TT&E as established in the overall institutional BCP. Testing, training and performing exercises of continuity capabilities is essential to demonstrating, assessing and improving HCC’s ability to execute the continuity program, plans, and procedures. Regular TT&E can help ensure the continuity program is becoming progressively more mature.	Testing, training and exercises will be conducted in conjunction with emergency operations plan testing, training, and exercises beginning Fall 2020.	Executive Director - Risk Management & Manager - Emergency Management	In Progress 10/30/2021	
	3	HCC BCPs are not maintained in a designated location. BCPs should be kept in a location where they can be easily accessed when needed. If operations are shut down in a disaster, the BCPs should be kept where individuals can quickly access plans for key information.	Business Continuity Plans often contain security sensitive and confidential information and this information cannot be widely shared. The departmental plans are made available by the respective plan owners among the key members of their team. The current year plans have also been added to the Office of Emergency Management SharePoint in a restricted folder. Permission to the folder can be granted by Risk Management or designated IT personnel when necessary. A permanent copy of prior year plans has been added to the Risk Management Laser Fiche document repository.	Executive Director - Risk Management	Completed 7/24/2020	
	
19-O-3 IT Disaster Recovery/Business Continuity Plan	1	Internal Audit obtained the 2020 IT Disaster Recovery and DR Assurance and Testing Plan for review during fieldwork. The document was last updated and signed off in February 2020. During review of the embedded files within the documents, IA noted that the last modified dates on some documents were not current. Documents such as the network diagram and employee contact information were not current.
Additionally primary contact phone numbers, and secondary contacts were not included in the IT Vendor/Service Provider contact list. The most up to date documentation may enhance HCC’s ability to successfully restore critical systems without delay.	As the audit spanned numerous months, Information Technology provided Internal Audit with a large number of supplemental documents, including up-to-date network diagrams, contact information, plan summaries, and ancillary support information. In the next IT DR Plan update, the embedded documents will be linked externally to ensure the referenced documentation is the most up to date and current. Recovery operations and related vendor contact information are tracked and managed by the respective IT team. IT Administrative Services and IT CSN will partner with the recovery operations leads to ensure this data is tracked in the aggregate vendor contact sheet.	Executive Director, Cyber Security & Network	In Progress 8/31/2021	
	
19-O-1 Student Behavioral Intervention	1	NaBITA standards suggest end of semester and end of year reports of BITAT activities that may identify trends and allow for adjustment of resources and training to position the team for continued success. Further, FLB (Regulation) charges Student Services with the responsibility for “generating reports that outline reported incidents and trends, notwithstanding other statutorily mandated reports”. While IA noted that various reports are being generated from Maxient, these periodic reports cover all case types, do not appear particularly helpful for understanding BITAT status and are not being provided to executive leadership.	Beginning Fall 2020, Maxient reports will be provided at the completion of each long semester (Fall and Spring) noting BITAT trends within the campus community.	Director - Counseling & Ability Services; Manager - Student Conduct & Academic Integrity	Completed 2/24/2021	

Project Name	
Obs #	

Observation Description	

Remediation Action	
Responsible Person	Status/Est
Completion Date	
	2	The NaBITA standards recommend using team meetings for professional development and other purposes when there are no cases to discuss. A large number of cases of the Concerning or Threatening Behavior type that are filed in Maxient are resolved at the campus level without requiring BITAT involvement. For awareness and oversight purposes, a summary of these cases should be presented in the routinely scheduled BITAT meetings to ensure the resolutions are appropriate.	Using a random sampling model, every month the BITAT will review 2-3 cases that were handled at the campus level. This quality control process is to ensure effective and appropriate case management on campuses and provide training and support as needed.	BITAT team	Completed 10/16/2020	
	
18-C-4 Required Regulatory Reporting	1	Of the 253 reports identified in the Compliance Calendar database, 34 reports had no Responsible Role assigned and 24 of those had no other Contributors identified. In these cases, the only individual who can be notified when reports are due is the Attestation DRI, increasing the risk of failing to file the report timely.	Beginning Fall 2020, Maxient reports will be provided at the completion of each long semester (Fall and Spring) noting BITAT trends within the campus community.	OGC; Compliance Office; Attestation DRIs	Completed 2/9/2021	
	2	Of 74 Contributors listed by name in the Compliance Calendar, 4 individuals are no longer active HCC employees.	Office of General Counsel informed the Attestation DRIs of their responsibilities at the Compliance Partners’ Council meeting on September 25, 2020. Attestation DRIs were requested to work with their teams to complete their entries by October 9, 2020. Office of General Counsel and the Compliance department are being added to the regular monthly distribution list from Talent Engagement of employees who have left HCC. OGC will consult with IT with respect to creating a process to automatically alert users when a Compliance Calendar member is no longer with HCC.	OGC; Compliance Office; Attestation DRIs	Completed 2/9/2021	
	3	Regulation BE Compliance Attestation has not been updated since the Compliance Calendar was established. The use of the Compliance Calendar needs to be included in the regulation. Additional improvements recently implemented in the Attestation process should also be reflected in the regulation.	Management believes that this process has been effectively described in BE2 (Regulation), currently posted on the HCC website as of September 16, 2020. BE2 (Exhibit) was added to the website on September 22, 2020.	OGC & Compliance Office	Completed 9/22/2020	
	
18-O-3 PeopleSoft Application Controls	1	Business Application Services Management provided IA with a listing of active PeopleSoft Finance accounts. This listing was compared against the HCC terminated user listing. IA noted two active PeopleSoft Finance accounts that belonged to two HCC employees that retired August 15, 2020. Through discussion with Business Application Services management, it was determined that employee ID numbers are not associated with PeopleSoft Finance user accounts; therefore, when terminations occur, disabling PeopleSoft Finance accounts is a manual process. The two PeopleSoft Finance accounts were disabled on October 5, 2020. The two employees’ active directory accounts were set to status retired and remain active due to a prior existing management decision to allow retired employees to retain an HCC e-mail address to preserve employee benefits. Controls need improvement to ensure terminated and retired employees’ PS accounts are disabled timely.	Both employees’ Active Directory (AD) accounts reflected terminated (Retired). They remained active in AD in order to allow the retirees to retain their HCC e-mail addresses. IT is working through the development of a process that will be implemented with the following controls to eliminate the noted observation.

1.	Create new retiree email accounts process for retired employees – reducing the need for manual intervention for retiree email account creation and eliminating the possibility of unnecessary user level access to AD authenticated applications via employee AD accounts

2.	Enhance the PeopleSoft Finance system to allow for seamless two-way integration between PeopleSoft and Active Directory to:
a.	Maintain active employee ids within PS Finance
b.	Create an integration process between PS HR and/or Active Directory to allow for real-time automation of account deactivation	IT/CORE Information Technology teams	1.	In Progress 12/17/2021
2.	In Progress 12/17/2021	

Project Name	
Obs #	

Observation Description	

Remediation Action	
Responsible Person	Status/Est
Completion Date	
	
21-C-5 Senate Bill 212	1	To ensure staff and faculty are aware of the SB 212 requirements , HCC established mandatory SB 212 training for all staff and faculty that was to be completed by November 15, 2020. The training was assigned to 4,088 staff and faculty that were shown to be actively employed on November 15, 2020. IA noted the following observations:
•	3,080 employees (75.34%) completed the training;
•	757 employees (18.51%) completed the training after the due date;
•	965 employees (23.60%) did not start the training as of the date of the audit January 6, 2021; and
•	43 employees (1.05%) started the training but did not complete the training. OIE needs to coordinate with the Chancellor’s Executive Council, OGC and Talent Engagement to establish enforcement procedures that will drive employees to complete mandatory training timely.	OIE conducted an audit of employees that had not complied with the mandatory SB 212 training requirement on January 15, 2021. OIE sent each member of the HCC Executive Council a detailed list of the employees under their supervision that had not completed the SB 212 mandatory training. The memorandum informed the HCC Executive Council member to follow-up with their staff to ensure compliance with the mandatory training directive. These notices were copied to the Chancellor. IE will continue to monitor employee participation on a weekly basis and will continue to address noncompliance with senior administrators with the expectation of compliance or application of appropriate corrective action.	Title IX Coordinator; Chancellor’s Executive Council	Completed 9/7/2021	
	2A	Rule §3.4 (d) (1) requires HCC to develop and implement a comprehensive prevention and outreach program. The program must address a range of strategies to prevent sexual harassment, sexual assault, dating violence, and stalking including a public awareness campaign, a victim empowerment program, primary prevention, bystander intervention, and risk reduction. HCC’s program can be improved by establishing a victim empowerment program.	Title IX Coordinator in partnership with the Student Services Division will develop a formal victim empowerment program that will be launched by September 2021.	Title IX Coordinator	Completed 9/7/2021	
	2B	Rule §3.6 (b) requires the Title IX coordinator or deputy Title IX coordinator must immediately report to the Chancellor an incident reported to the coordinator if the coordinator has cause to believe that the safety of any person is in imminent danger as a result of the incident. HCC needs to formally establish this reporting framework
and protocol.	Title IX Coordinator will develop the departmental policy for the reporting of an imminent danger situation by April 15, 2021.	Title IX Coordinator	Completed 4/15/2021	
	2C	Rule §3.7 (1) requires HCC to provide an anonymous reporting option for an enrolled student or an employee to electronically report to HCC an allegation of sexual harassment, sexual assault, dating violence, or stalking committed against or witnessed by the student or employee, regardless of the location at which the alleged offense occurred. HCC needs to communicate this electronic anonymous reporting option to employees and enrolled students.	The Maxient Reporting Form has been modified to provide information regarding how to provide an anonymous report for sexual misconduct to the Title IX Coordinator. The OIE Title IX Webpage will be modified to reflect these changes.	Title IX Coordinator	Completed 4/15/2021	
	2D	Rule §3.4 (a) requires HCC to adopt a policy on sexual harassment, sexual assault, dating violence, and stalking. Rule §3.4 (b)(1) requires HCC to make its policy on sexual harassment, sexual assault, dating violence, and stalking available to students, faculty, and staff members by including the policy in the student handbook and personnel handbook or equivalent. The policy will be included in the student and faculty handbooks. HCC does not have a handbook for administration employees, so an institution equivalent needs to be identified.	OIE will take additional steps by reviewing current New Employee Orientation programming and making any necessary updates providing all new employees information related to HCC’s policy regarding sexual harassment, sexual assault, dating violence, and stalking as well as their mandatory reporting of sexual misconduct obligations. As an institution equivalent to an administration employees handbook, OIE will provide bi-annual awareness notices to all HCC employees regarding their sexual misconduct mandatory reporting obligations and ensure that annual mandatory training for all employees covers this subject.	Title IX Coordinator	Completed 9/7/2021	

Project Name	
Obs #	

Observation Description	

Remediation Action	
Responsible Person	Status/Est
Completion Date	
	3	Reviewing a list of sexual incidents that were not subject to a full investigation by OIE, IA noted that investigators closed cases without providing documents to support the reason for not investigating, and did not document the supervisor’s consent to close cases. Reasons need to be documented for cases not subject to a full investigation. These cases need to be reviewed and closed by the OIE manager to ensure the information in the Chancellor’s Report is accurate. To comply with the Texas Administration Code (TAC) Title 19 Part 1 Chapter 3 Subchapter A Rule §3.6 (c), HCC must present the Chancellor’s Report to HCC’s Board of Trustee and post the report on the HCC website annually, including the number of reports received and the number of investigations conducted as a result of these reports. OIE should establish internal procedures for this annual reporting.	OIE acknowledges and accepts that additional supporting relevant documents and case notes regarding the rationale for why certain cases do not warrant a full investigation would be beneficial. While there is no regulation or policy that requires the Title IX Coordinator to sign off on closure of cases not being investigated, OIE also acknowledges and accepts that a procedure requiring a closure note from the Title IX Coordinator or designee would be a helpful quality control action. To address this issue OIE will establish a Sexual Misconduct case management procedure which includes providing written clarification regarding why a case will or will not be subject to an investigation. The procedure will also include a provision that the Title IX Coordinator, Deputy Title IX Coordinator or designee will provide a closing review for cases involving allegations of sexual misconduct.	Title IX Coordinator	Completed 4/15/2021	
	
20-S-4-1 Quarterly Control and Compliance Attestation	1	The DRIs are required to perform checklist reviews in the seven key areas included in the attestation letter and sign-off on whether any exceptions are observed.
Adding the checklist of operating responsibilities for DRI review was a significant improvement to the attestation process. While performing the process walkthrough, IA interviewed three of the DRIs. Copies of documents that evidence the checklist reviews performed were requested from the three DRIs. The three DRIs provided little or no documents evidencing the reviews performed. However, one DRI provided copies of subsidiary attestation letters that the DRI requires their management team members to sign-off indicating whether any exceptions were observed in their areas of responsibility. The OGC and the DRIs should collaborate to develop a documentation baseline for DRIs to retain evidencing their quarterly reviews.	OGC has provided Attestation Training, described above, on January 22, 2021; February 10, 2021; and March 2, 2021, which training has been included in the Compliance Reports Calendar for access and regular referral. OGC has notified Attestation DRIs by e-mail on March 9, 2021 concerning their expected documentation plan. OGC will confirm by e-mail with Attestation DRIs in advance of the next attestation cycle (FY2021 quarter 3) that the DRIs have collected their due diligence documentation in advance of Internal Audit’s review.	General Counsel; Compliance Director; Attestation DRIs	Complete 5/31/2021	
	2	In reviewing procedure BE2 (REGULATION), IA observed that no reportable exception definition is provided. A reportable exceptions definition would provide the DRIs with guidance on the types of issues to consider in their review process. The definition should include reportable exception examples such as the following (but not limited to):
•	Stolen or lost HCC assets
•	Fraud incidents, including conflict of interest violations
•	Regulatory compliance violations
•	Purchases made in violation of HCC procurement policies and procedures
•	Issues that threaten the good standing of HCC accredited programs
•	Internal control framework weaknesses that threaten the health of people or a major financial loss
Client attorney privileged exceptions are reported separately to the BOT and not included in the attestation letter reporting.	BE2 (Exhibit) provides to DRIs a framework to identify reportable exceptions. Inclusive in the Attestation Training module provided are instructional protocols for each of seven items comprising the attestation letter, recommended process review practices, and examples of appropriate due diligence documentation. OGC and Compliance believe that the language has been clarified by the actions that have been taken, which are described in Management’s Responses to Observations 1 and 3.	General Counsel; Compliance Director	Completed 3/2/2021	

Project Name	
Obs #	

Observation Description	

Remediation Action	
Responsible Person	Status/Est
Completion Date	
	3	Training was discussed with three of the DRIs during the attestation process walkthrough. Attester staff members received training on the use of the Compliance Calendar to ensure compliance with required regulatory reporting. The DRIs meet annually with Risk Management and IA to review their risk registers to complete the annual Enterprise Risk Management Assessment. However, the interviewed DRIs indicated that they would appreciate formal training on the review and reporting expectations of DRIs. The interviewed DRIs indicated they are challenged in determining the criteria expected to satisfy the attestation letter statements. The interviewed DRIs mentioned that annual attester refresher training would be beneficial. In addition, they noted that training should be provided to onboard new DRIs timely.	Training has been completed. OGC has provided Attestation Training on January 22, 2021; February 10, 2021; and March 2, 2021, which training has been included in the Compliance Reports Calendar for access and regular referral. OGC has notified Attestation DRIs by e-mail on March 9, 2021 concerning the expectations of the attestation process. For onboarding new DRIs, newly assigned attesters will be trained either within 30 days of their assignment or at the time the Chancellor’s Office requests attestation letters, whichever is sooner. OGC will continue to regularly update Attestation DRIs concerning the attestation process through the Compliance Partners’ Council.	General Counsel; Compliance Director	Completed 3/2/2021	
	
21-A-3 External Quality Assurance Review (Basil Woller and Associates)	1	Standard 1000 Purpose, Authority, and Responsibility – Strengthen organizational independence of Internal Audit by specifically defining the nature of the functional reporting relationship with the Audit Committee in the Internal Audit Charter.	Appropriate Internal Audit Charter revisions defining IA's functional reporting relationship with the Audit Committee will be made in the February 2022 scheduled Charter review.	Director - Internal Audit	In Progress 2/2/2022	
	2	Standard 1000 Purpose, Authority, and Responsibility – Consider developing and
using an “Internal Audit Charter Matrix” to monitor and report the status of requirements embedded in the Internal Audit Charter.	An “Internal Audit Charter Matrix” will be developed and presented with the February 2022 scheduled Charter review.	Director - Internal Audit	In Progress 2/2/2022	
	3	Standard 1210 Proficiency – Consider developing and using an internal auditing
competency framework to support talent and resource management activities within Internal Audit and to demonstrate professional proficiency.	An internal auditing competency framework to demonstrate professional proficiency will be developed with September 1, 2021, targeted implementation.	Director - Internal Audit	In Progress 11/1/2021	
	4	Standard 1220 Due Professional Care – Continue efforts to expand and enhance the use of data analytics to support Internal Audit risk assessment, planning, and engagement processes. The self- assessment team identified this as an opportunity in
planning materials for their self-assessment.	IA is currently in the process of procuring TeamMate Analytics software. The software is more user friendly than the software currently in use. We expect to have the software loaded for use by June 30, 2021. Data analytics consideration is a required
step in planning every audit project.	Director - Internal Audit	Complete 7/31/2021	
	5	Standard 1300 Quality Assurance and Improvement Program – Update documentation of the QAIP in the Internal Audit Manual to reflect changes in the Standards and to support consistency, quality, and sustainability of its execution.	QAIP documentation in the Internal Audit Manual will be updated to reflect changes in the Standards with June 30, 2021, targeted completion.	Director - Internal Audit	Completed 6/1/2021	
	6	Standard 1311 Internal Assessments – Consider enhancing the periodic internal
assessment process by evaluating the level of effectiveness or maturity of Internal Audit related to the Core Principles.	The periodic internal assessment process will be enhanced with a maturity level to Core Principles evaluation included in next internal assessment targeted for June 30,
2022.	Director - Internal Audit	In Progress 6/30/2022	
	7	Standard 2040 Policies and Procedures – Continue efforts to enhance Internal Audit Manual to support consistency & sustainability for execution of defined and documented processes.	Internal Audit Manual continuous improvement is an ongoing effort and is formally reviewed each year in September. Each staff member is required to acknowledge understanding the department’s policies & procedures and code of ethics.	Director - Internal Audit	Ongoing	
	8	Standard 2050 Coordination and Reliance – Consider enhancing the Internal Audit risk assessment and audit planning process by providing an assurance map in the annual audit plan presentation that describes coverage of risk between Internal Audit
and other providers of assurance for HCC.	An assurance map will be included in the annual audit plan presentation scheduled for August 4, 2021, that describes coverage of risk between Internal Audit and other providers of assurance for HCC.	Director - Internal Audit	In Progress 8/3/2022	

Project Name	
Obs #	

Observation Description	

Remediation Action	
Responsible Person	Status/Est
Completion Date	
21-C-4 Title IX New Regulations	1	A discussed two cases with the Title IX Coordinator. The investigations of the two cases were completed and the final investigation reports were issued in spring 2021. For both cases, OIE can modify procedures to ensure that proper documentation exists to support that:
1)	Prompt notification is provided to the complainant and respondent soon after receiving the initial complaint.
2)	The respondent is provided a written notice for initial interviews in a timely fashion.
3)	There are timely and appropriate case notes are made in the Title IX case file.	OIE will update the departmental procedures to ensure that proper documentation exists.	Director, EEO/Compliance & Title IX Coordinator	In Progress 9/30/2021	
	
21-O-2 IT Active Directory and Windows Server	1	IA noted Microsoft Windows 7 and Windows Server 2003 still in service. Microsoft officially ended software updates and security patches for Windows 7 in January 2020 and Windows Server 2003 in July 2015. Through discussion with IT network security HCC is aware that Windows 7 and Windows Server 2003 systems are no longer receiving updates. The affected servers are segregated in a separate Virtual Local Area Network (VLAN) with a hardened system configuration. HCC is in the process of upgrading or decommissioning those systems. Computers running operating systems that are no longer receiving security patches may increase the risk that known computer vulnerabilities can be exploited.	1.	One of the identified Windows Server 2003 will be powered down by 9/30/2021. The second Windows Server 2003 system would have its services migrated to a compliant/supported operating system by December 2021. Upon confirmation of service migration to a new complaint server, the non-compliant server will be decommissioned.
2.	The remaining Microsoft Windows 7 PCs will be upgraded by the end of the first quarter, 2022.	Director, Enterprise Sys Admin Serv; Exec Dir, Campus Tech Serv; Dir, Cyber Security & Compliance	In Progress
1. 12/31/2021
2. 3/31/2022	
	
21-O-4 IT Change Management	1	IA obtained the CM process document for review during fieldwork. This document was last updated in April 2021. This process document serves as the framework that documents the workflow, roles, procedures and policies needed to implement changes. During review of the document, IA noted the following:
1.	Criteria for priority and impact are not defined and fully implemented;
2.	Minimum documentation requirements for different change types are not clearly defined;
3.	ServiceNow is not being utilized as the system of record for storing supporting documentation (test, back-out and verification plans).
The documentation should be updated to reflect the current process, including additional definitions. IT Management, in consultation with Records Management, should consider the extent to which ServiceNow’s document storage capabilities should be used.	1.	Priority and Impact fields will be removed from the Change form, as these fields were only intended for use with ServiceNow (SNOW) Incident SLAs and serve no additional value-added purpose for the Change form. Additionally, by removing these fields from the Change form there is then only one system of record for collection of this information that is contained in the originally intended source system.
2.	IT will work with Records Management to develop an internal process for securely housing critically sensitive information.
3.	In keeping with industry standard best practices security protocols, and to mitigate cyber security threats and attacks, ServiceNow (as an externally vendor hosted system) will not be used to house detailed information related to HCC infrastructure. An internal secured means for housing this critically sensitive information has been operationalized.	Manager Application Development, IT Change Management	In Progress 1. 11/1/2021
2. 12/31/2021
3. 1/17/2022	

Project Name	
Obs #	

Observation Description	

Remediation Action	
Responsible Person	Status/Est
Completion Date	
	2	Formal training for ServiceNow and the CM process was last conducted in 2019. When the CM process document is updated and approved by executive management, IT should consider conducting formalized training, maintaining evidence of attendance and potentially producing an electronic archive that can be used for onboarding new IT employees and for reference. This would reinforce IT personnel’s understanding of the process and individuals’ roles and responsibilities. Additionally, IT had not distributed reports related to change requests since April 2020. Periodic management reports that include metrics and trends related to change requests would bring awareness to items of interest and enhance HCC’s ability for remediation of any failed or rejected changes, meeting of SLA’s or other
issues.	IT Change Management is collaboratively working with the IT Executive Leadership team to set Change Management training goals for IT staff, interns, and contractors for the 2021/2022 calendar year. Going forward, the IT Change Management training calendar will identify and reflect those topics and training initiative timelines as aligned with the vision and business expectations of IT leadership.

A standard reporting feature is already a part of ServiceNow and this will be recommunicated during training.	Manager Application Development, IT Change Management	In Progress 1/31/2022